Onetime Secret alternative: OncePad vs Onetime Secret
Both share a secret through a link that works once. The difference is where the key lives.
Short answer: OncePad is a free, no-account service for sharing a password, secret, or file through an end-to-end encrypted link. The link contains no decryption key, works once, and expires after 24 hours. Files may be up to 25 MB.
Where they agree
Onetime Secret is the long-running original in this space, and the shape is the same: paste a secret, get a link, the recipient opens it once, it's gone. Both are free to use without an account and both support passphrase protection. If you're happy with Onetime Secret, this page won't try to talk you out of it — it explains what OncePad does differently so you can pick the model you want.
The core difference: browser encryption, and a link that carries no key
Onetime Secret documents server-side encryption, encryption at rest, and optional passphrase protection. OncePad starts from the other end: encryption always happens in your browser (AES-256-GCM, key derived by PBKDF2 from a passphrase), the server never receives anything but ciphertext, and the passphrase is generated (7 words, ~72 bits) for every secret. The OncePad link therefore carries no key; the words go on a second channel.
Side by side
| Feature | OncePad | Onetime Secret |
|---|---|---|
| Encryption location | Browser, before upload (end-to-end) | Server-side; encrypted in transit and at rest |
| Key placement | Derived from a generated passphrase sent separately; no key in link | Service-managed encryption; optional user passphrase |
| File support / limit | One browser-encrypted file up to 25 MB | No file-upload limit documented in the primary pages reviewed |
| Expiry | Exactly one reveal or 24 hours | One retrieval; lifetime configurable within plan limits |
| Accounts | No account | Anonymous use plus optional accounts/plans |
| Open-source status | Hosted app source not publicly released | Open source; official documentation links the repository |
When Onetime Secret may suit you better
If you want optional passphrase protection, longer expiry windows, regional hosting, an account with additional features, an API, or a mature self-hosting story, Onetime Secret offers those. OncePad deliberately trades that flexibility for a smaller surface: one model, no accounts, nothing on disk for text secrets.
When OncePad is the better fit
If the requirement is that no server ever holds the key, that the link can sit safely in a ticket or chat log, that the passphrase is strong by default rather than by discipline, and that the whole thing is gone from memory after one read — that is exactly what OncePad is built for.
Last verified: August 18, 2026. Descriptions of Onetime Secret are based on its primary documentation and are given in good faith; editions, limits, and policies change, so verify them before deciding. Onetime Secret is a trademark of its respective owner and is not affiliated with OncePad.